Overview

overview

10

Static

static

10

8f06f8a601...ce.exe

windows7_x64

10

8f06f8a601...ce.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f06f8a601b7cae793c0ce06739742e2a1fdbba3e956e95739faeb7a87ef7dce

  • Size

    89KB

  • Sample

    220130-2jqr6sbebq

  • MD5

    127cd711193603b4725094dac1bd26f6

  • SHA1

    255ebd7c7276d9b9e9e7cc3119afe66696a8a0ea

  • SHA256

    8f06f8a601b7cae793c0ce06739742e2a1fdbba3e956e95739faeb7a87ef7dce

  • SHA512

    f71adfeba536d70edd8b76ee60a5639b9b5f9b3251a51a762154226fce7deabd65cc813d01b1428eedfcc122b0630dd6b91f503904697806b2b2ea84d1db5479

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      8f06f8a601b7cae793c0ce06739742e2a1fdbba3e956e95739faeb7a87ef7dce

    • Size

      89KB

    • MD5

      127cd711193603b4725094dac1bd26f6

    • SHA1

      255ebd7c7276d9b9e9e7cc3119afe66696a8a0ea

    • SHA256

      8f06f8a601b7cae793c0ce06739742e2a1fdbba3e956e95739faeb7a87ef7dce

    • SHA512

      f71adfeba536d70edd8b76ee60a5639b9b5f9b3251a51a762154226fce7deabd65cc813d01b1428eedfcc122b0630dd6b91f503904697806b2b2ea84d1db5479

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks